Batch file to delte local profiles

Clarifications

This might help in your situation depending on the type of worm you have got.

Removal instructions:

If your system is infected with the worm first please download this REG file and install it (by double-clicking on it):

ftp://ftp.europe.f-secure.com/anti-virus/tools/sirc_dis.reg

This will remove the worm's reference from the EXE file startup key and the main worm's startup key in the Registry.

Warning! The system might become unusable if the worm's file is deleted without modifying the EXE file startup key first.

After that the system can be safely disinfected with F-Secure Anti-Virus. If for some reason the worm's file can't be deleted from Windows (locked file), then you have to exit to pure DOS and delete the worm's file manually or use a DOS-based scanner (F-Prot for DOS for example). Note that for 100% disinfection all worm's files needs to be deleted and Registry should be fixed (see above).

Additional Note: If a workstation was infected trough a network share '\windows\run32.exe' has to be renamed back to '\windows\rundll32.exe' after disinfection.

The extra line in 'autoexec.bat' file that starts the worm from \recycled\ folder should be removed also.

Network infection prevention:

If a network is infected and it is not possible to take it down to disinfect all workstations, the following method can prevent the worm from spreading to clean workstations:

In the \Recycled\ folder of a drive where Windows is installed, it is needed to create a dummy file with SIRC32.EXE name and read-only attribute.
More here:
http://www.f-secure.com/v-descs/sircam.shtml

Please post back if you have any more problems or questions.
If this information is useful, please mark as helpful. Thanks.

For a start I don't think that you will be able to modify the Registry with a batch file while the Virus is active as all you will get is open with and an error.

Luckily the virus doesn't edit the registry entry for ?run as? so its possible to correct this situation.

First go to the location C:\WINDOWS

You'll find a file named regedit.exe.

Right click on the file and select run as,you can actually run any file this way but its cumbersome so we'll fix it.

Unselect the option ?Protect my computer and data.....?

your regedit is open.

I don't like your chances but you are welcome to try these on a test PC as you will probably have to modify them to suit.

One of these two should work to remove it from the Registry you will have to test them, name it del.reg.

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@=-"c:\windows\system32\drivers\spools.exe \"%1\" %*"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@=-"C:\\WINDOWS\\system32\\drivers\\spools.exe \"%1\" %*"

This will add the right syntax to the Registry, name it add.reg

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"

This is how the batch file is structured EXAMPLE:

@echo on
C: regedit /s del.reg
goto s2

:S2
C: regedit /s add.reg

goto s3

:S3
C:
del C:\WINDOWS\system32\drivers\spools.exe
goto s4

:S4
C:
del "%username%\local Setting\Application Data"\Spool.exe :User will have to logon for it to work.

OR

cd "C:\Documents and Settings"
del /s /q /f spools.exe :Could be dangerous if you make a mistake.
goto end
:END

Some anti virus programs are able to delete the virus but do not change the registry entry.

Leading to a situation where non of the programs can run. Opening any program gives the open with options.

NOTE: The virus when present in the system prevents the installation of most anti viruses

http://midnight-freak.blogspot.com/2008/06/w32mandaph-spoolsexe-cftmonexe.html

I have just checked Symantec's site and it has a few more registry entries that may need to be modified.

http://www.symantec.com/security_response/writeup.jsp?docid=2008-042816-0445-99&tabid=3

This is how I would do it and once it is under control I would install MalwareBytes. Update it and run it in Safe Mode.

From another PC download and install these two programs and copy the the installed folders to a USB Stick.

Restart the PC in Safe Mode and run Sophos and then run Spybot.

Download Spybot - Search & Destroy 1.5.2 and install it. Update it. http://www.safer-networking.org/en/download/index.html

Download Sophos and the latest IDE Files. Install it and extract the IDE files to the C:\SAV32CLI folder.

http://www.sophos.com/support/knowledgebase/article/13251.html

Copy and paste the below two lines into Notepad and save the file to the USB Stick as sophos.bat, it will scan and remove. When the Scan has finished check the log file to see what it hasn't removed. You will normally find the answer to this via Google.

===============================

CD SAV32CLI

SAV32CLI -REMOVE -P=C:\REMOVLOG.TXT

===============================

The Sophos SAV32CLI folder can be safely deleted after it is copied to USB.

Download Malwarebytes Anti-Malware, install it and update it and scan the PC in Safe Mode.

http://download.bleepingcomputer.com/malwarebytes/mbam-setup.exe

< edit to add goto end >

Keep us informed as to your progress if you require further assistance.

If you think that any of the posts that have been made by all TR Members, have solved or contributed to solving the problem, please Mark them as Helpful so that others may benefit from the outcome. ;) :D